The 'Scanning the Harness' supply-chain audit (2026-09-10, arXiv 2609.07360, ev-20260910-08): 16.0% of 3,171 public GitHub repositories (2,600 Claude Code/Cursor/Copilot/Codex configs + 511 published skill sets) carry at least one security defect — 9.8% install unpinned MCP servers, 3.1% pre-approve arbitrary execution behind scoped-looking grants, and 3.8% of skills carry pre-approved shells; every finding was independently re-derived and dual-adjudicated, with tools, corpus manifest and adjudications released — the first quantified audit of the MCP/skills config supply chain and the first independent academic measurement on the security-demand side (verified 2026-09-11)
What does enterprise MCP adoption require?
Evaluate MCP connectivity separately from enterprise governance. The archive can inform pilots, but identity, least privilege, quotas and audit must be tested in the actual deployment.
As of 2026-09-27 · Analysis based on archive evidence
Scope of the answer
For teams connecting enterprise systems and protected data. Protocol support alone does not establish production readiness.
Open questions
- Do discovery and invocation enforce the same identity and permissions?
- Are policy and audit consistent across vendors?
Supporting material
LiteLLM 1.102.0 stable (2026-09-20, ev-20260913-01 update): Agent Skills discovery, per-user MCP tool authorization, customer-managed KMS and routing telemetry reach a stable gateway build; this makes the control plane trialable but remains one project without an interoperable auth/enforcement specification
Google Cloud API Gateway MCP (September 24, 2026, ev-20260924-08): existing REST APIs become MCP tools while reusing JWT, quotas and logs; unauthenticated-by-default `tools/list` shows that enterprise discovery still needs explicit policy
More evidence · 1
Cloudflare One Gateway MCP detection/enforcement GA — `experimental.is_mcp`, Portal-only enforcement, OAuth pre-registration (2026-08-14, primary source, ev-20260814-03)
Counter-evidence
No direct counter-evidence is recorded. That alone does not establish the conclusion. Independent reproduction and actual deployments remain the next checks.